Money gone from your bank account in Nepal: what to do now

Call your bank's card-blocking or 24-hour helpline and block the card. Every commercial bank in Nepal publishes this number on the back of the card, on the branch door and on its website, and it is staffed outside branch hours precisely for this. If you cannot find it, the mobile banking app almost always has an in-app card freeze that works instantly and does not depend on anyone answering a phone. Freeze first, ask questions afterwards — an unfreeze takes a minute and an unrecovered debit takes months.

Blocking the card is not the same as blocking the account, and this is where people lose money in the second hour. If the debits are card-present ATM or POS transactions, the card block is enough. If they are internet banking transfers, mobile banking transfers, wallet loads or QR payments, the card is irrelevant and you need mobile banking and internet banking access suspended as well. Say both things explicitly on the call: block the card, and suspend digital banking access on the account pending investigation.

Then ask the single question that decides your dispute later: what is the reference number for this block, and at what time is it logged. Write it down with the name of the person you spoke to. Nepali banks log helpline calls, but a reference number in your own notes is what lets you say, in writing, that notification happened at a specific minute. Without it you are relying on the bank to find its own record of a call you cannot describe.

If the account is on a joint mandate or is a business account, block it anyway and sort out the internal politics later. A partner or co-signatory who is annoyed that the account was frozen without consultation is a far smaller problem than a second night of outbound transfers. The same applies to salary accounts — a frozen account that cannot receive your salary on time is inconvenient, and an emptied one is not.

Do not do any of this from a phone you suspect is compromised, and do not follow a link in the SMS that alerted you. If the debits started after you installed an APK sent on Viber, WhatsApp or Messenger, treat the handset as hostile: it can show you a clean screen while approving transactions behind it. Use a family member's phone, a landline or a branch, and deal with the device afterwards.

Finally, check every other account and wallet linked to the same phone number or email in the same fifteen minutes. Account takeover in Nepal very rarely stops at one institution, because the same number receives the OTPs for the bank, the wallet and the email that can reset both. Blocking one card while the linked wallet is still live is the most common half-measure we see described in these cases.

Nepal's retail payments run over several distinct pieces of infrastructure, and the dispute route follows the rail rather than your feelings about it. Nepal Clearing House Ltd operates connectIPS, the Retail Payment Switch, the National Payments Interface, electronic cheque clearing, connectRTGS and NEPALPAY QR under Nepal Rastra Bank's oversight. Fonepay runs the QR and direct-transfer network you see inside mobile banking apps, and holds a Nepal Rastra Bank licence as an authorised payment system operator. Card transactions ride the card schemes. Your bank sits at one end of all of them.

Look at the transaction narration on your statement, not at the amount. An ATM withdrawal names a terminal and a location. A POS purchase names a merchant. A connectIPS or interbank transfer names a beneficiary account or an alias. A Fonepay QR payment names a merchant and a network. A wallet load names the wallet. Each of those tells the investigating officer a different story and each has a different counterparty who can be asked to hold funds.

Whatever the rail, your first formal counterparty is your own bank. This is the part people get wrong when they go straight to the payment operator or the wallet: the account is the bank's contract with you, and the bank is the licensed institution that Nepal Rastra Bank supervises for how it handles your complaint. Nepal Rastra Bank's Financial Inclusion and Consumer Protection Division exists for financial consumer protection and complaint handling and redress, and it works on the basis that the licensed institution has been given the chance to resolve the matter first.

That said, notifying the operator in parallel does no harm and can help. Fonepay publishes a complaint portal at complain.fonepay.com along with a support email, a phone line and a named grievance officer. Nepal Clearing House publishes a support line for its systems. Where the debit is a card transaction at a merchant, the merchant is also a real counterparty — a purchase that has not yet been shipped or delivered is far easier to stop at the merchant than to claw back through a scheme dispute weeks later.

Distinguish the fraud case from the mistake case, because they diverge completely. If you sent the money yourself to the wrong person, that is a wrong-transfer problem: the transaction was authorised, the refund has to be initiated from the receiving side, and the route is different. If you did not authorise it at all, this is the page you want. Banks and police both treat those two as separate categories and describing yours wrongly at the counter will send your file down the wrong corridor.

One practical note on ATM disputes. A machine that debited you and dispensed nothing, or dispensed short, is not fraud — it is a cash-out failure, and it is usually resolved from the ATM's own journal and cash-balancing record within the bank's own timeframe. Raise it the same way and in writing, but do not fold it into a fraud complaint, because mixing a mechanical failure with an allegation of unauthorised use slows both.

A phone call stops the bleeding; a written application starts the dispute. Go to your branch the same working day, or email the branch and the bank's customer service address the same night if the branch is shut, and follow up in person. The document you are producing is not a letter of complaint in the emotional sense. It is a dated, signed record of what you say happened and when you told them, and it is the single most useful thing in your file three months later.

List each disputed transaction on its own line: date, time as shown on the statement or SMS, amount, the narration exactly as printed, and the channel. Do not summarise as a single total. Investigators and card scheme disputes work transaction by transaction, and a lump-sum claim gets sent back for itemisation, costing you a week you did not have to lose.

State plainly that you did not authorise the transactions, that you did not share your PIN, password or OTP with anyone, and where the card was physically at the relevant time. If you did share an OTP because you were deceived on a call, say so honestly — it changes the analysis and it may weaken your position, but a dispute built on a false account of events collapses the moment call records are pulled, and it can turn a sympathetic file into an adversarial one.

Record the notification timeline in the application itself: the time you discovered the debit, the time you called the helpline, the reference number for the block, and the time digital banking was suspended. This is the paragraph that does the work. Liability in practice tends to be argued around the moment of notification, so make that moment a documented fact rather than something to be reconstructed later.

Ask for four specific things in writing: acknowledgement of the complaint with a complaint or reference number, a statement of the account covering the disputed period, confirmation of what the bank has blocked and when, and the name of the officer handling the file. A branch that gives you a stamped copy of your own application with a receipt number has, in effect, agreed on the record that you complained on that date. Never hand over your only copy.

Preserve evidence before it disappears. Screenshot the SMS alerts with the timestamps visible, screenshot the transaction list inside the app, download or request the statement, keep the CCTV request in mind for ATM disputes, and note the physical location of the card and of you. If the debits are card-present transactions in a city you were not in, your own travel evidence — a bus ticket, a hotel bill, attendance at work — is worth more than any argument you can make.

Then keep every subsequent contact in writing. If the bank calls you with an update, reply by email summarising what you were told and asking them to confirm it. A file that consists entirely of phone calls is a file with no history, and it is the kind of file that quietly stops moving when the officer handling it is transferred.

Nepal treats unauthorised withdrawal as a named criminal offence, not merely a civil dispute. The Banking Offence and Punishment Act, 2064 prohibits withdrawing money in an unauthorised manner from another person's account, withdrawing by stealing another person's cheque, and transferring funds in an unauthorised manner from a customer's account. A separate provision prohibits obtaining or making payment by way of abuse or unauthorised use of a credit card, debit card, automated teller machine card or other electronic means. That is your case described almost word for word.

The unofficial English translation of that Act cited below sets punishment in bands that rise with the amount claimed, and — importantly for you — sets a limitation period: a first information report is to be filed within one year from the date the offence became known, with the case lodged within a further six months. Treat that as a reason to report early rather than as a comfortable window. The authoritative text is the Nepali version published by the Nepal Law Commission, and anything turning on the exact wording should be checked against it or with a lawyer.

Where the debit came through an online channel — internet banking, a wallet, a cloned app, a phishing link, a call that extracted an OTP — the Nepal Police Cyber Bureau is the specialist unit. Its reporting page publishes downloadable complaint forms by category, including one specifically for online financial fraud, alongside forms for hacked or fake accounts and for unauthorised access. Use the financial fraud form rather than the general one; it routes the file correctly.

You do not have to travel to Kathmandu. The Bureau's own guidance is that complaints can be submitted at any district police office, local or ward office or police station, at the Bureau in Bhotahiti in Kathmandu, or by email to [email protected] if you cannot attend in person. Its published contacts are 9851286770 and 01-5319044, with Police Control on 100 and a toll-free line on 16600141516. Nepal Police also runs a general citizen assistance and complaint system through its own website.

What the Bureau asks for is specific: clear screenshots and any hyperlinks or URLs involved, presented so they can actually be read, plus an identity document — citizenship certificate or passport, or a birth certificate for a minor. Add your bank statement for the disputed period, the bank's acknowledgement of your written complaint, and the SMS alerts. A complaint that arrives with the bank paperwork already attached is a complaint that can be acted on immediately.

Understand what the police case does and does not do for your money. A criminal investigation can trace a beneficiary account, support a request to hold funds, and produce the finding that a bank often wants before it will treat a debit as fraud rather than as your own authorised transaction. It does not, by itself, credit your account. Run the police complaint and the bank dispute in parallel and give each side a copy of the other's paperwork — the police report number in your bank file, and the bank acknowledgement in your police file.

Nepal's other main cyber statute, the Electronic Transactions Act, 2063, is the general computer-crime law the Bureau works with, and it may apply alongside the banking offence provisions where a device or account was accessed without authorisation. Which charge is laid is the investigating officer's call, not yours.

Once your written dispute is in, the bank does three things in some order: it pulls its own logs, it decides whether the transaction can be reversed through the rail it travelled on, and it forms a view about whether your credentials were compromised through the bank's systems or through you. Those three strands produce the outcome, and they move at different speeds.

The logs are more detailed than customers expect. Card transactions carry terminal identifiers, merchant identifiers, whether the chip or the magnetic stripe was read, and whether a PIN was verified. Digital banking transactions carry device identifiers, IP addresses, session times and OTP delivery records. This cuts both ways. If a cloned magnetic-stripe card was used at a terminal while your chip card was in your pocket, the log helps you enormously. If your own registered device and your own OTP were used, the log is what the bank will cite when it declines.

Reversal is only available while the money is still catchable. A card purchase that has not yet been settled to the merchant can sometimes be stopped outright. Once settled, the route is a scheme dispute — the process people loosely call a chargeback — which is a structured claim between your bank and the merchant's bank under the card network's rules, with its own reason codes, evidence requirements and deadlines. Those deadlines are set by the scheme and are not negotiable by your branch, which is the real reason a week's delay in reporting matters.

For domestic account-to-account transfers there is no chargeback in the card sense. What exists instead is a request from your bank to the receiving institution to place a hold on the credited amount pending investigation, and the receiving bank's willingness to act on it. That is fast when the funds are still sitting in the beneficiary account and useless once they have been withdrawn in cash or pushed onward through a wallet, which in these cases is often within minutes.

Ask your bank three questions in writing rather than accepting a general assurance: has a hold been requested on the beneficiary account, has a scheme dispute been raised and under which reason code, and what is the expected date of a decision. Written questions produce written answers, and written answers are what Nepal Rastra Bank can act on if you have to escalate. A verbal it is under process is not a position you can appeal against.

Be realistic about the likely split of outcomes. Card-present fraud where the genuine card was demonstrably elsewhere, and system-side compromises, are the strongest cases. Cases where an OTP was handed over on a phone call, or where a hostile app on the customer's own handset approved transactions, are the hardest, because the bank's position is that its authentication worked exactly as designed. Hard is not hopeless — but go in knowing which category the bank will place you in, because it determines whether your effort is best spent on the bank, on the police, or on both.

Nepal Rastra Bank runs a grievance management system for financial consumers at gunaso.nrb.org.np, operated by its Financial Inclusion and Consumer Protection Division through a Financial Consumer Protection Unit. The Division's published functions include financial consumer protection, complaint handling and redress, and market conduct supervision — that last phrase matters, because it means NRB's interest is in how the institution behaved, not only in your individual loss.

The sequence is bank first, regulator second. Register your complaint with the bank, give it a genuine opportunity to resolve the matter, and escalate to NRB when the bank has declined, has not responded, or has responded in a way you can show is inadequate. This is why the stamped acknowledgement from the branch matters so much: it is the document that proves the first stage happened and on what date.

Registration is online. You sign in to the grievance system, register the complaint, and the system issues a registration number by email. That number is how you check the status of the complaint afterwards, and the final decision is communicated by email as well. Keep the registration number with your bank complaint number and your police report number — a complete file with three reference numbers is treated very differently from a narrative with none.

The Division publishes direct contacts alongside the portal: [email protected], [email protected] and a set of Baluwatar phone lines. Nepal Rastra Bank also states that complaints can be registered by application at its offices during office hours, which matters for anyone without reliable email or for a complaint that runs to a bundle of documents.

Be precise about what you are asking NRB to look at. A complaint that says the bank stole my money will go nowhere. A complaint that says the bank was notified at a stated time on a stated date, was given an itemised written dispute on a stated date, did not acknowledge it, did not raise a scheme dispute, and has not communicated a decision — that is a market-conduct complaint with dates attached, and it is the shape NRB can act on.

Know the perimeter. NRB supervises licensed banks and financial institutions, and its supervision departments are organised by class of institution, with a separate division for microfinance and non-bank financial institutions. Entities outside that perimeter — an unlicensed lender, a savings and credit cooperative, an app that is not a licensed payment service provider — are not NRB's to discipline, and a complaint against them belongs somewhere else. Check who your money was actually with before choosing the door.

Finally, remember the parallel track. The regulator's grievance route is about the institution's conduct. If the underlying event is a crime, the criminal case still has to be pursued through the police, and NRB's decision on the bank's handling does not substitute for it. Running both is normal, not excessive.

The worst version of this is not a skimmed card. It is a bag or a wallet that contained the debit card, a photocopy of your citizenship certificate, a cheque book, and the phone that receives your OTPs. That combination gives someone the card, the identity document used to verify you at a counter, the paper instrument that can be presented, and the second factor that authorises everything else. Treat it as an identity emergency rather than a card problem.

Order of operations matters. Block the card and suspend digital banking first, as above. Then block the SIM with your mobile operator and get a replacement on the same number, because the number is the recovery key for the bank, the wallets and probably the email account behind them. Then change the password on the email account from a clean device, because email is what resets everything else. Then deal with the handset itself, including remote lock and wipe and reporting the device.

The cheque book is a distinct exposure and is often forgotten. Report the specific cheque numbers as lost to your branch in writing and ask for stop payment instructions on the range. A stolen cheque presented with a photocopied citizenship certificate is exactly the scenario the banking offence provisions on unauthorised withdrawal and stolen cheques were written for, and a stop instruction on the record is your protection while the case runs.

Then think about the documents rather than the money. A photocopy of your citizenship certificate in a stranger's hands has a long tail: it turns up in SIM registrations, in loan applications, in cooperative memberships and in account openings. Report the loss of documents to the police and get a record of that report, and be alert for a year to any account, SIM or facility you did not open. Checking your own credit record periodically is the cheapest early warning available.

Do not assume the theft was opportunistic. Where a phone and a card go together, the debits often begin within minutes and are structured to stay under thresholds that would trigger a call from the bank. That pattern is worth stating in your written dispute, because a rapid series of small debits immediately after a reported theft is a stronger evidential picture than a single large one, and it is the sort of detail that gets a hold request issued quickly.

One thing to be careful about: do not let a helpful stranger, a shop, or a caller claiming to be from the bank take you through recovery. Banks in Nepal do not call to ask for your PIN, your password, your OTP or your full card number, and a fraud that begins as a theft frequently continues as a phone call from someone who now knows your name, your bank and your number. Ring the bank on the number printed on its own website or on the back of a replacement card, never on a number you were given.

The commonest way to lose is delay. A debit noticed on Friday night and reported on Monday morning has passed through the window in which funds sit catchable in a beneficiary account and, for card transactions, has eaten into scheme deadlines that nobody at your branch controls. No version of waiting helps you, including waiting to see whether the money comes back.

The second commonest is an inconsistent account of events. People change their story between the helpline call, the branch application and the police form — the card was in the drawer, then it was in the bag, then it might have been used at a petrol pump. Investigators notice. Write your account down once, carefully, on the night it happens, and use it everywhere afterwards.

The third is having no documents. A dispute file that contains a stamped bank application, a statement, timestamped SMS screenshots, a block reference number, a police report number and an NRB registration number is a file that an officer can approve. A dispute that consists of a customer's recollection of several phone calls is a file that stalls, and stalling is functionally the same as refusal.

The fourth is escalating to the wrong body. Going to Nepal Rastra Bank before the bank has been given a written complaint, or to the Cyber Bureau about an ATM that failed to dispense, wastes the weeks you cannot spare and teaches you nothing. Match the route to the problem: bank for the account, police for the crime, NRB for the bank's conduct, and the payment operator or merchant where the rail or the counterparty can act.

There is also a category of case where the honest answer is that recovery is unlikely — money pushed rapidly through several accounts and withdrawn in cash, or a transfer you were deceived into authorising yourself. Even then, file everything. A traceable pattern across many victims is how these networks are eventually charged, and your complaint is a data point in that even when it does not restore your balance. Nobody should promise you otherwise.

Be equally sceptical of anyone who does promise. A recovery agent, a consultant or a social media contact who offers to get your money back for a fee is the second fraud, and it targets people who have already demonstrated both a loss and desperation. The routes in this guide are the routes; they are free, and no intermediary has a faster channel into a bank, the Cyber Bureau or Nepal Rastra Bank than you do.

When it is over, change what made it possible: separate the account that holds your savings from the one your card and apps touch, keep the card's daily limits low and raise them only when you need to, turn on transaction alerts on every channel, and check your statement weekly rather than monthly. The reason those habits matter is not that they prevent fraud. It is that they cut the time between the first unauthorised debit and your phone call, and that interval is the whole game.